Description
Papra’s webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations.
Recommendation
Update the @papra/webhooks package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.3
- Patched version(s): 0.3.3
References
Could your website be exposed too?
SmartScanner can check your website for Papra HTTP redirect bypass can lead to SSRF via webhook delivery system and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader - CVE-2026-27795
- Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
- @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
- Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
You might also like:
See something that needs correcting? Let us knowUpdated June 10, 2026